Facebook Pulls Pages Linked to Rightists Active in Balkans

Facebook has taken down at least 14 pages identified in a BIRN and BBC collaboration as linked to the Knights Templar International, KTI.

KTI – which calls itself “a living shield and sword for the defence of Christian communities and the upholding of Christian principles” – has boasted about how its vast network of social media pages helped to elect Donald Trump as US President and swing the UK referendum on leaving the European Union.

Current news feature items on its website hail “a huge drop in abortions in Russia” and the upcoming referendum against gay marriage in Romania.

The organisation has attracted controversy for its hard-line views on Muslim immigration to Europe and donation of equipment to so-called “migrant hunters” in Bulgaria and to Kosovo Serbs preparing for confrontation with Kosovo’s mainly Muslim Albanian majority.

The news of Facebook’s decision was first reported by activists at the International Report Bigotry and Fascism.

It also published a letter, apparently from KTI, appealing for funds to fight Facebook and blaming mainstream media “smears” for the decision.

The letter claimed that 20 “British, American, Australian and European pages” were pulled on Friday, September 7, with a total of 3 million Facebook likes.

BIRN has not independently verified the authenticity of the correspondence.

However, on September 7, KTI published a statement on the social media site GAB, which is popular with the right, saying Facebook “has launched another big purge on surviving ‘right-wing’ & Christian accounts today”.

Facebook and KTI did not respond to requests for comment.

The Knights Templar International is named after the medieval Catholic crusading monastic order, founded in the 12th century, which played an important part in the wars in the Holy Land against Muslims. Originally based in Jerusalem, the order was forced later to shift base to Cyprus. The order was dissolved by the Pope in 1312 and many of its member executed.

The modern organization, which has no links to the Vatican, has been linked to the Scottish-born far-right and anti-abortion activist James “Jim” Dowson, called an “extremists’ marketing mastermind” by the UK Times, although he denies playing any official role in the organisation.

In 2016, Dowson was banned from Hungary, formerly a key centre in the KTI network, as part of a wider crackdown by the Hungarian authorities on far-right activists using their country as a base.

He and the KTI have since increasingly used Belgrade for their media activities. Dowson is meanwhile appealing the Hungarian decision.

KTI’s activities in Serbia include filming videos from the capital, helping to launch websites and training right-wing groups and activists in how to win the “information war”.

Alongside media training, the KTI – which Dowson describes as a “militant Christian order” – has also supplied equipment to volunteers on what it calls the frontline between Christianity and Islam.

It has used its funds to provide tactical vests (protective body armour) and communications equipment to Serbian groups in the volatile area of northern Kosovo, and to vigilante groups stopping migrants from crossing the Bulgarian-Turkish border.

While Dowson did not respond to BIRN’s requests for comment, in a response to the Scottish-based Sunday Post, he described the connection between him and the sites as “fake news”.

He added: “There are no Facebooks [sic] that I own down, removed or even restricted.
“However, I do see in the media many instances where the tech giants are removing thousands of platforms from Christian, conservative and pro-Brexit organisations. I think that’s deeply worrying for the rule of law and democracy.”

Facebook told the Sunday Post: “We have removed these pages as they breached our community standards.”

Bosnia’s Politicians Decide Tweets Won’t Win Elections

Social media may play a huge part in political life in the US and other countries – but the top politicians running for office in Bosnia’s upcoming parliamentary and presidential elections in October don’t seem that interested in Facebook or Twitter.

Fan pages reveal that some key politicians do not use Facebook at all.

Milorad Dodik, President of Republika Srpska and head of its ruling Alliance of Independent Social Democrats, SNSD, who is campaigning for the Serbian seat on Bosnia’s state presidency, does not even have an official account.

The situation is the same with the Prime Minister of the entity, Zeljka Cvijanovic, who is standing as a candidate for Dodik’s old position as RS President.

Their actives are promoted only on the official Facebook page of the party.

Dragan Covic, Croatian member of the Bosnian presidency and head of the main Bosnian Croat party, the Croatian Democratic Union, HDZ, who is a candidate for the same position, also has no personal Facebook page or profile.

On the other hand, Mladen Ivanic, candidate for the Serbian seat on the Bosnian presidency, who is already serving a mandate in this position, has a Facebook fan page – but with only 6,165 likes.

Vukota Govedarica, another candidate for the position of president of Republika Srpska, also has a Facebook fan page, with 7,809 likes.

Sefik Dzaferovic, candidate for the Bosniak seat on the Bosnian presidency, from the main Bosniak party, the Party of Democratic Action, SDA, has a recently registered Facebook fan page with 10,991 likes.

His main rival, Fahrudin Radoncic, leader of second strongest Bosniak party, Alliance for Better Future, SBB, has 23,894 likes on his Facebook page.

Denis Becirovic, candidate for the same position as Dzaferovic and Radoncic, from the main opposition Social Democratic Party, has 21,322 likes on his Facebook page.

When it comes to Twitter, only Dragan Covic has an active profile, with 268 tweets, 1,280 followers and 52 followers. The other key candidates remain loyal only to Facebook.

Bosnian politicians “use these profiles or pages to promote their everyday activities, especially now during the campaign, but that is rather formal – they do not share personal things or opinions or any similar details,” Ivana Maric, a Sarajevo-based political analyst, told BIRN.

But Maric explained that the situation was quite different when it comes to the candidates running for the state or entity-level parliaments.

“There will be a lot of candidates and many of them will be using social media very actively, though sadly, most of those accounts will be deleted or forgotten as soon the votes are counted,” Maric said.

Bosnian Officials Spend 4.5 Million Euros on Vehicles

In the first six months of the year, around 4.5 million euros was spent on vehicles for government officials, institutions and public companies in Bosnia and Herzegovina, according to BIRN Bosnia’s new database.

Of this sum, 1.5 million euros were spent on cars, some of them luxury models. The other three million euros were spent on vehicles like fire trucks, ambulances and SUVs.

A total of 292 tenders were issued to purchase the vehicles, but in more than 70 per cent of the tenders that were fulfilled, only one company applied, the database shows.

Bosnian government institutions and public companies published tenders to purchase 563 vehicles during the six-month period, around half of which were passenger vehicles and SUVs.

So far, 106 tenders have been fulfilled to buy 213 cars – 128 of them new and 38 secondhand, and in the other cases details have not been made public.

The most expensive vehicle purchased in the first six months was for the medical faculty of the Mostar University, in a tender worth 50,000 euros.

Mostar medical faculty dean Milenko Bevanda first issued the tender in late 2017, but annulled it after receiving BIRN’s request for a comment about the purchase.

But in spring this year, Bevanda repeated the tender and bought a new vehicle worth 42,300 euros without taxes from the MRM company in Ljubuski.

BIRN’s database shows that in the first six months of this year, MRM won the most valuable tenders, worth over 375,000 euros.

Porsche BH from Sarajevo won the most tenders, valued at a total of 285,000 euros.

Of the 292 issued tenders in the database, BIRN marked 26 tenders in which the requested specifics of the vehicle are so detailed that they can limit competition or suggest a preferred manufacturer, which is against the country’s public procurement law.

In six tenders, the final value of the tender or purchase exceeded the amount which was planned.

The Bosnian Serb Interior ministry bought six used vehicles for more than 10,000 euros more than the estimated amount.

In the rest of the tenders, the demanded specifics of the vehicle suggest or sometimes directly state a particular model or manufacturer, which is against the public procurement law.

BIRN Bosnia published an analysis in December showing that around five million euros was spent on vehicles in 2017.

After BIRN’s reports about violations of public procurement practices, several institutions amended their tender specifications.

The database also contains a register for vehicles already owned by institutions and public companies, which shows that the average cost of a vehicle is around 25,000 euros.

The Bosnian presidency and the two entity presidents own a total of 54 cars, worth around 1.7 million euros.

The database can be seen here (Bosnian language only).

Read more:

Bosnian Serbs to Protest Over Officials’ Luxury Limos

British Nationalist Trains Serb Far-Right for ‘Online War’

When militant Christian campaigner Jim Dowson was banned from Hungary in April 2017 for posing a “danger to national security”, he was able to protest his innocence – and even appeal for funds for his legal defence – across a sprawling network of websites and social media pages which dwarfs many mainstream media outlets and political parties.

Research by the Balkan Investigative Reporting Network, BIRN, which collaborated with the BBC for this investigation, has found that at the centre of this lucrative spider’s web of patriotic sites is the Knights Templar International (KTI) portal, which is named after the famous Medieval Christian crusaders and is closely tied to Dowson, although he denies having any official role in the organisation.

Its jokey memes, patriotic videos and far-right material are  shared across 14 Facebook pages which have earned 2.5 million ‘likes’ from the social network’s users – including three serving British MPs, this investigation can reveal.

The KTI insists it is not a racist organisation, but the BIRN has also uncovered inflammatory language being used across its media platforms – Muslim communities in Western Europe referred to as “rats’ nests” and Roma branded a “criminal scum caste”.

With Dowson now banned from Hungary, formerly a key hub in the network, he and the KTI are turning increasingly to Belgrade for their media activities, we can reveal.

This includes filming ‘news’ videos from the capital, helping to launch websites and training far-right groups and activists, some with questionable pasts and connections, in how to win an ‘online war’.

Alongside the media training, the KTI, which Dowson describes as a “militant Christian order”, is preparing for what it believes is imminent war between Islam and Christianity by building a network of groups which will become militias when fighting begins, Dowson explained in an interview with James Kelso  for the right-wing radio programme ‘The Trump Phenomenon’ in January.

KTI’s support has included providing tactical vests (protective body armour) and communications equipment to unnamed Serb groups in the tinderbox area of northern Kosovo.

Dowson declined to answer most of BIRN’s questions but strongly denied any connections to neo-Nazis.

‘Britain’s most influential far-right activist’

Dowson is a Protestant Scot who grew up in the shadow of violence in Northern Ireland. He says he fought and was wounded as a combatant against the Irish Republican Army, IRA, a paramilitary group which carried out a campaign of bombing across the UK as it attempted to unify Ireland.

After working as an anti-abortion activist, Dowson helped the far-right British National Party raise large sums while working with Nick Griffin, the party’s leader, who once served as a member of the European Parliament and now frequently works with Dowson in Serbia.

Dowson then set up the Britain First nationalist group in 2010 before leaving it in 2014.

London-based anti-fascist organisation Hope not Hate claims Dowson helped Britain First secure more than a million Facebook followers by mixing “emotive memes” with “hard-hitting right-wing and socially conservative material”, turning it into a major force online, although it had no success at the ballot box.

The staunchly anti-immigration movement came to the world’s attention in November 2017 when US President Donald Trump retweeted two controversial videos posted by one of the group’s leaders.

Britain First was removed from Facebook in March after the social media network said it had “repeatedly posted content designed to incite animosity and hatred against minority groups”.

Hope not Hate claims in its February 2017 report, that following his departure from Britain First, Dowson then used Budapest as a base to run a network of “patriotic” websites and set up a hub for his latest venture,  KTI. Similar findings were also documented by the International Report Bigotry and Fascism.

In the same report, Hope not Hate named Dowson as “Britain’s most influential far-right activist”.

“His social media skills have raised his profile in the European far right and opened doors to new political and professional relationships,” the anti-fascist campaigners added. The Times of London called him an “extremists’ marketing mastermind”.

Dowson has boasted on videos posted across the KTI network of running “one of the world’s large media companies”, and “having been being credited with the Brexit result and helping elect President Trump”a claim which mirrors that made in KTI’s own annual reports.

In January, he gave an hour-long interview with ‘The Trump Phenomenon’Radio show about the work of the KTI. In it, Dowson was introduced as the “director or main consultant for the Knights Templar”.

During the interview, he boasted of the reach that the KTI’s social media had built.

“One of the things we do as a modern order is we run huge social media sites right across the world,” he said. “We had about 30 guys – 30 young Europeans, Hungarians, Serbs, Brits, Irish during the Trump election campaign. We were the guys punching out all the emotive memes.

“We were producing thousands of them per week. We were reaching at one point 70 million Americans per week,” he claimed.

He did not name the social media pages, but BIRN has identified 14 Facebook pages whose content has come predominantly from the KTI or linked websites. Since January 25, the KTI’s membership page has been shared 500 times across 11 of these Facebook pages.

The Facebook pages are named to appeal to different sections of the social network’s audience, such as “Newschicken”; “Proud to Wear my Poppy ” and “President Trump – Make America Great Again”, said Andrej Petrovski, a Belgrade-based cyber forensic specialist who worked with BIRN on this investigation.

“They [KTI] are using the possibilities offered by social media to micro-target people from different walks of life, from hooligans to nurses to MPs, serving them with content that is appealing to a particular group,” Petrovski explained.

“This has resulted with over 2.5 million followers across several pages on Facebook, which is more than the followers of the UK Conservative and Labour party on Facebook combined. This number means quite a substantial reach, as the reach exponentially grows with the number of followers,” he said.

Petrovski added that finding three serving British MPs, as well as hundreds of health workers and British civil servants among those liking the pages, was worrying. “With civil servants liking these pages, the likelihood of other people doing the same is higher, which is why public figures should pay attention what they promote through their activities on social media,” he said.

Dowson’s role with the KTI is, however, obscured by his insistence that he is not a member of the organisation.

He has previously admitted to assisting the KTI with “one or two projects”, but also said he did not hold a “position, title or authority”. He claims he is currently  suing BIRN for an earlier story related to his activities in Kosovo.

Evidence obtained by BIRN suggests however that he is an important player for the organisation, even though he claims that he does not hold an official position.

Dowson has been a regular public face for KTI, presenting many of its videos, speaking to the media as a representative of the group and giving speeches at events.

He has been described on the KTI’s website as a KTI “brother”, a “spokesman” and “valued and trusted advisor” – although the KTI has recently removed many of these pages.

The Northern Ireland-based company listed on the website as the recipient of KTI membership fees, Knights Templar International Novus Ordo Militiae Limited, is owned by Dowson’s sister-in-law Marion Thomas, who worked with him at the British National Party and was a director of one of his earlier firms.

Dowson is himself owner of The Rosslyn Portal Limted which operates the rosslynportal.com website, selling identical memorabilia to the KTI website, and is hosted on the same IP as knightstemplarinternational.com. Until recently, another website, thelifeleague.com, was also hosted on that IP address and was registered personally by Dowson.

His contacts in Serbia, including Dejan Damjnajovic, of the Order of the Dragon, and Filip Milinic, leader of Generation Identity, identified Dowson as a senior figure in KTI.

A fresh start in Serbia

Dowson was banned from Hungary in April 2017 because, he said, he posed a “danger to national security” – something he denies strenuously. He is currently appealing the decision through the courts in Budapest and the KTI has sought donations for the legal costs through an appeal on the website.

In Serbia, however, Dowson and Griffin, who was also banned from Hungary and is appealing against the decision, appear to have found a new hospitable base to pursue some of their activities.

Since March last year, more than a dozen KTI news have been filmed in Serbia and uploaded to various YouTube channels, including Templar News and Knights Templar International  and to the websites in the network, and have been shared on social media.

The presenter of these reports, BIRN has discovered, is Marina Milenov, a young Serb who reads out far-right material in front of a superimposed panorama of the Serbian capital Belgrade.

The number of views on YouTube ranges from the low hundreds to thousands, but their impact is amplified by repostings on Facebook and linked websites. One video posted to the Knights Templar International’s Facebook account had been viewed 40,000 times at the time of this article’s publication.

In one clip, uploaded to YouTube, about the ‘Great Replacement’ – the theory that white Europeans are being replaced by immigrants – Milenov explains that foreigners are “people who want to destroy everything you hold dear” and who are responsible for “the “gang rape of huge numbers of your women”. Milenov then says the KTI is calling for “serious resistance” to be built up ahead of the “Islamic uprising”.

Serbia is not just providing a base for videos, it is also a “social media hub” for the KTI, according to its 2017 annual report. Dowson and the KTI declined to elaborate on this assertion.

But when asked about his activities in Serbia by BIRN last year, Dowson was modest. “I run a small marketing company and take on roles from many clients and it would be a gross breach of professional standards to discuss these roles with you or anyone else,” he said in a written statement issued last year.

Contacted by phone, Milenov declined to comment.

Dowson also helped launch a new nationalist website, Novigvozdenipuk.rs, for a Belgrade-based pro-monarchy group. Novi Gvozdeni Puk is a World War I regiment in what was then the Kingdom of Serbia.

The website was created for the Belgrade-based, monarchist Order of the Dragon, which has a number of ties to Dowson and the KTI.

Reporters discovered that the Novigvozdenipuk.rs website shares a unique Google Analytics ID, which allows the owner to track traffic, with the Knights Templar International website.

The Order of the Dragon leader Dejan Damnjanovic confirmed that he had worked with Dowson on the website, which went online last summer, but explained that it had later been taken down. The linked Facebook page remains active.

Retrieved Facebook pages from a now-deleted section show the website was published by TPS Media, which gave the same address in central Belgrade as one posted by KTI on its “contacts page”. BIRN was unable to find a company of that name or the location of the office, but tpsmedia.eu is registered at the same IP as Knights Templar International and, until very recently, thelifeleague.com, which was registered by Jim Dowson personally.

“It’s his [Dowson’s] company,” Damnjanovic said of TPS Media.

Waging an ‘internet war’

In his January interview for US radio programme ‘The Trump Phenomenon’, Dowson explained the importance KTI placed on providing free courses on media to ensure that “our people [are] fully trained in modern means of communications”.

This tallies with a Facebook message posted to his personal page in January. Accompanying three photos of what appeared to be Dowson training a group of men, he wrote: “The modern war is fought on-line…for now!”

A Twitter post from the same event explained he was “media training in Serbia”. While it is not clear whether this event was linked to the KTI, a flag of the organisation is visible on one of the tables on one of the photos.

The identity of the group being trained has not been revealed, but one far-right organisation which admits receiving social media advice from Dowson is the Belgrade branch of Generation Identity, an international anti-immigration movement.

Filip Milinic, leader of Generation Identity (GI), told the BBC: “Jim [Dowson] has a reputation of being very skilled in social [media]. He did offer advice and it was various useful, because now, for example, we have over 7,000 likes on Facebook.

“It has been very helpful, and we hope they will come again soon,” he added. Milinic later denied that GI had received any “training” from Dowson when contacted for clarification yesterday.

A photograph from 2016 shows Milinic and another far-right activist Marko Gajinovic, meeting Dowson and Griffin in Belgrade for an event organised by another right-wing group, NSF, at which Griffin spoke.

A few days later, photos were posted to the KTI’s Facebook page showing Gajinovic with various figures cloaked in Templars’ robes holding the Templars’ and the Serbian flags.

Both Milinic and Gajinovic attended a small rally in March to commemorate WWII-era Serbian Prime Minister Milan Nedic, who led a Nazi puppet government. Gajinovic was photographed apperently performing Nazi salutes and the Belgrade prosecution told BIRN that the incident is now under investigation.

Milinic said the event was not organised by GI and that Gajinovic was not a member of his group. Gajinovic did not respond to requests for comment, but in a Tweet denied there were any “Sieg Heils” at the event, saying the photos showed people gesticulating like at a sports event.

Dowson said he had not trained Generation Identity in Serbia and had fought against Nazis all his life.

In a written response to BIRN, he said: “As I have seven live legal cases regarding false media allegations against you and several other Soros/Western funded puppet fake news outlets in the courts at Belgrade, I am limited in response.

“However, let me be very clear: at no time have I ever supplied media or IT or any other kind of training to those groups mentioned, Generation Identity or Neo Nazis in Serbia.”

Dowson and Griffin have also built a close relationship with Misa Vacic, the former head of the far-right 1389 group – named after the year of the famous Battle of Kosovo, a touchstone for Serbian nationalists.

Vacic was briefly an adviser to Marko Djuric, the head of the Serbia’s Office for Kosovo, in early 2017, and invited Dowson and Griffin into the government building.

In 2013, Vacic was given a suspended jail sentence for discrimination against the LGBT community.

But when Vacic launched a new far-right movement last year, Serbian Right, a senior member of the ruling Serbian Progressive Party was also present, raising further questions about Vacic’s connections to the government after his spell as an adviser.

At the organisation’s second major meeting in February, Vacic invited Dowson, Griffin and Russian intellectual Leonid Savin, who edits the website of Konstantin Malofeev, who has been sanctioned by the US for support for pro-Russian separatists in Ukraine.

Dowson told the audience that they needed to work together to counter the threat of immigration. “The West is flooded with hordes of Islamic conquerors from the east, sixty million of them and still counting,” he said.

Since then, Dowson and Griffin have made a number of trips to Belgrade to train Serbian Right in social media skills, according to press releases and social media postings by the movement.

“Our friends, Dowson and Griffin, are the true masters of their craft,” Vacic said in a press release. “Their experience is precious to us, their desire is to transfer to us their techniques and knowledge with which we will be able to continue our political fight.”

Vacic declined to comment. In response to BIRN’s question about his activities in Serbia, Nick Griffin wrote:

“Tell whatever lies and twist whatever truths you want, the corrupt Washington-centric world for which you are propaganda prostitutes is coming to an end. Europe will be free and Christian, and Kosovo Je Srbija [Kosovo is Serbia].” [click here for full comment]

Marinika Tepic, a MP for the left-wing Nova Stranka party, says she was taunted online by Vacic and members of Generation Identity after she raised the issue of Dowson’s activities in parliament and his delivery of equipment to Kosovo Serbs

Following her statement, graffiti attacking her was painted across the city and one nationalist journalist is due to face trial for allegedly issuing a death threat.

Tepic said that she had been informed that some extremist groups even began to call her “Jo” in private messages, in reference to Jo Cox, the British MP murdered in 2016 by a far-right extremist.

There is nothing to connect Dowson to any these incidents, but Tepic told BIRN that she believes he sees Serbia as his “new target”. “His words are dangerous,” she added.

In his interview with ‘The Trump Phenomenon’, Dowson described his trip to Kosovo to deliver equipment: “We took a huge consignment of bullet proof vests and tactical equipment and comms equipment just a few months ago, we took them into Kosovo, which is quite hazardous, I was on that journey, I was on that convoy.

“When we took them in, and of course the Western media wanted us arrested, you know, they tried to imply that I was supplying arms – look, taking arms to the Balkans is like taking arms to Texas – there is no need.

“Communication equipment and sophisticated modern stuff is needed, but you don’t have to take arms to Kosovo, believe me,” he said.

He later added in the same interview: “Right now we don’t need AK-47s, right now we need technology – the AKs will come later.”

In an interview recorded with the BBC following publication of this article, Dowson “apologised unreservedly” for his comments on “AKs”, adding: “That’s an extremely bad turn of phrase.

“The Balkans are awash with arms – to suggest that me or anybody else would be nudge, nudge, wink wink “we’ll get you arms” is utterly ludicrous.”

Additional reporting by Kreshnik Gashi.

This investigation is produced by BIRN as a part of Paper Trail to Better Governance project.

This article was updated on May 2 to include comments from Jim Dowson, broadcast in an interview for BBC Radio 4  following publication of the article

 Whistleblower alleges lucrative network

A whistleblower told the BBC, as part of its collaboration with BIRN for this investigation, that the sprawling network of websites and Facebook pages linked to Knights Templar International is also lucrative.
Information seen by BIRN shows that the 19 websites registered under one Google Advertising account [which does not include knightstemplarinternational.com] made at least 60,000 euros since 2016.
The Google Ads account is currently registered to The Patriot Society, a firm owned by Marion Thomas, Dowson’s sister-in-law, but the address given is Dowson’s home.
The bank account currently registered to receive payments is Brightnote Limited, a Northern Irish firm fully owned by Dowson, although it is not clear how much money it has received.
All 19 websites had disappeared last night when BIRN checked, including their archives, but cached pages showed that the most popular sites had been publishing well into April.
In a live interview with the Victoria Derbyshire show on BBC2, Dowson said: “I don’t make any money from any ads. I do not have any wallet with any money.
“This guy [the whistleblower] spoke their about £100k going into a single wallet held by Jim Dowson – it is nonsense.”
According to an earlier interview with Dowson, KTI has 5,000 members in the US alone, representing potential earnings of $445k a year if each is paying the $89-a-year fee.
Dowson told the BBC in an interview recorded following publication of this article: “I personally have […] never made a single penny on any website from advertising, ever.”
But he added: “It is possible that companies that I am associated with have earned money from Google Ads. Where that money then went – I don’t know – I will need to look into it.”

Romania Remains Hub for Cyber-Crime Gangs

Several cyber-crime cases dismantled by Romanian police in cooperation with international law enforcement show that the Eastern European country is still a hub for cyber-related crime.

Italian and Romanian police recently dismantled a cybercrime gang that stole 1 million euros from hundreds of customers of two major European banks, Europol announced on Thursday.

Police arrested 20 suspects, nine in Romania and 11 in Italy, after a two-year investigation.

The organised crime group was essentially comprised of Italian nationals used phishing emails impersonating tax authorities to harvest the online banking credentials of their victims and then transferring the money to Romania.

The money was withdrawn from ATMs in Romania with credit or debit cards linked to the criminal accounts. Europol said they are also suspected of money laundering, drug and human trafficking, prostitution and of participation in a criminal organisation.

A wave of high-profile cyber-crime cases, including an unemployed Romanian taxi driver who called himself “Guccifer” and hacked the emails of former US Secretary of State Colin Powell and former President George W Bush in 2011, have also put a spotlight on the dark side of Romania’s growing IT industry.

After the US Embassy said that in 2011 alone Romanian hackers stole 1 billion dollars from Americans, US law enforcement authorities have in recent years kept in close contact with cybercrime units in Bucharest.

A Romanian national, Nicolae Popescu, is the second most wanted on the FBI’s cybercrime list, with a 1-million-dollar reward for his arrest.

He escaped arrest in 2010, before the Romanian police could produce a warrant. Popescu was involved with an estimated 250 Romanians in the “Valley of the Kings” case, the country’s biggest cybercrime bust; the perpetrators allegedly stole 750.000 euros by faking auctions on e-Bay.

The FBI put Popescu on the wanted list in 2012 after he allegedly set up a similar scheme that has sold numerous Americans fake items on various websites.

In February 2017, Romania’s Court of Appeal decided to extradite two Romanians to the US who had allegedly hacked into 123 Washington Police Department outdoor surveillance cameras just before US President Donald Trump’s inauguration. They demanded ransom money to unlock the blocked computers.

Mihail Isvanca, 25, and Eveline Cismaru, 28, were arrested in December 2017. They have been charged by a US Federal court with fraud and computer crimes.

The case was given high priority as the two Romanians’ actions impacted the US Secret Service’s mission and may have affected the security plan for the President’s inauguration.

Also, in December 2017, police in Romania arrested five suspects for allegedly spreading ransomware and renting the malware from an outfit on the Dark Web.

According to Europol, Romanian police have worked with Dutch counterparts and public prosecutor’s offices, as well as with law enforcement agencies in the UK and the US.

Europol says that in early 2017, the Dutch High Tech Crime Unit tipped off Romanian authorities about a group of Romanian nationals who were behind a wave of spam that pretended to originate from well-known companies in countries such as Italy, the Netherlands and the UK.

Europol says the operation identified more than 170 victims from several European countries.

With the fifth fastest internet speed in the world, Romania is one of the EU countries most vulnerable to cybercrime, according to studies.

In September 2017 it ranked third, after Malta and Greece in a vulnerability index published by Website Builder Expert, WBE.

However, Romanian authorities have developed cyber-crime fighting units that have been cooperating well in international cases.

Romanian police cooperated in a Europol led case to break up a a cybercrime syndicate of Ukrainian and Russian nationals that allegedly stole more than 1 billion euros from bank accounts over five years.

Since 2014, Romania has also led a NATO cybercrime defence unit that counters cyber attacks from Russia in Ukraine.

Facebook Data Row Makes Waves in Romania

The Facebook data row surrounding British analytics company Cambridge Analytica has made waves in Romania, after a consultant revealed that the company scouted him to secretly work for Romania’s ruling Social Democratic Party in its triumphant 2016 election campaign.

Cambridge Analytica is in hot water after after it was revealed that it obtained access to more than 50 million Facebook users’ data in 2014.

This was then collected, shared, and stored without users’ consent and allegedly used in the 2016 Brexit referendum and the US presidential elections.

Both the British government and the European Union on Tuesday announced investigations into the company’s activities.

Meanwhile, a British public relations consultant and writer, Rupert Wolfe Murray, revealed on Facebook on Wednesday that Cambridge Analytica had scouted him in 2016 to work for Romania’s Social Democratic Party.

“I saw the Channel 4 report about Cambridge Analytica and they mentioned an East European country where they went in secretly and successfully manipulated an election. No name was given. ‘Nobody knew we were there,’ said the boss,” Murray said on his Facebook account.

“I recognised the boss’s name and found some emails from him dating August 2016. He’d offered me a job, but when he told me it was for the ruling party, which went on to win the election, I declined,” he added.

In 2017, RISE Project reported that Strategic Communications Laboratories Group, SCL, the British strategic communication company that owns Cambridge Analytica, had set up an office in Romania in 2011.

The SCL branch in Romania was still active in 2017, when it signed a lobbying contract  with US-based firm Andreae & Associates.

The US lobbyist was asked to “provide government relations, communications counsel, and public affairs services for SCL Social relating to their anti-corruption efforts in Romania.”

The Social Democratic Party won the Romanian elections in December 2016 with 46 per cent of the votes and now controls the government.

In a press release on Wednesday night, the party denied working with the analytics firm in 2016 or any other electoral campaign.

However, the CEO of the Romanian branch of SCL, Peter Imre, said that his company never worked with any Romanian political faction.

The developer of the personality application that collected the data of over 30 million Facebook users and passed them to the British firm is a Moldovan-born psychology research at Cambridge University, Aleksandr Kogan.

Kogan told the BBC that he had no knowledge of how the information was subsequently used.

Analysts say that there are hundreds of apps like Kogan’s that are popular in Eastern Europe, whose users do not know that the apps allow companies behind them to collect, store and even sell their data.

Mihaela Pana, a Romanian journalist specializing in cybersecurity who writes for Cyber Media, says that after the row involving Cambridge Analytica broke last week, she looked closely at the apps her friends used on Facebook.

She followed up on what type of companies were behind them and realized that all quizzes used the same app for processing pictures, and that she had trouble finding contact information on the company behind the app in the Terms of Agreement.

Ioana Avadani, a media analyst and director of the Center for Independent Journalism in Bucharest, said that what Cambridge Analytica did was not only illegitimate but illegal.

“The problem was not that Cambridge Analytica profiled users, but that it fed those profiles with fake information,” she told BIRN.

“If it fed those profiles with real information, it would still be legal … Facebook also analyses my interest and prioritizes my feed. But the problem appears when you disseminate fake info into those profiles,” she added.

Russia’s Fancy Bear Hacks its Way Into Montenegro

The innocent sounding email reached an official of the Montenegrin Defence Ministry in early January 2017.

Entitled: “NATO_secretary_meeting.doc”, it sounded like a communiqué from the Western alliance that Montenegro was soon to join.

However, IT experts say the message was not sent by NATO to update Montenegro on useful information.

It came from a notorious Russian hacking group, which wanted to break into the government’s IT systems and steal state secrets.

Also in January, according to BIRN sources, the Podgorica government received two more similar emails.

The subject line of the first read: “Draft schedule for British army groups’ visit to Montenegro”.

The title of the other was: “Schedule for a European military transfer program”.

All are believed to have come from the same Russian hacker group, which experts say is linked to the Kremlin.

Three international IT security companies say the emails came from APT28, also known as Fancy Bear, which US intelligence services say is connected to the Russian military intelligence service, GRU.

European Union officials also believe that Montenegro suffered a serious cyber attack in June 2017.

Over the last two years, Montenegro authorities have recorded a sharp rise in the number of cyber attacks, mostly targeting state institutions and media outlets.

From only 22 such incidents in 2013, almost 400 were recorded in only nine months of 2017, official data obtained by CIN-CG/ BIRN show.

Not all are related to malware viruses or attacks on state institutions, and not all the attacks can be attributed to Fancy Bear.

But many of the attacks are believed to be linked to the tiny Adriatic country’s decision to join NATO, which infuriated the country’s old ally, Russia.

Montenegro has since tightened up cyber security defences. It has formed a specialised police taskforce to fight cyber crime.

But with only limited resources, the team greatly depends on the help of NATO and other Western countries.

“After serial attacks in early 2017 we sought help from NATO and the UK to help us fight back. We succeed in reducing the damage and repelled two attacks in late 2017,” a senior police officer told CIN-CG/ BIRN, declining to provide details of those actions.

CIN-CG/BIRN’s investigation shows that the rise in cyber attacks coincided with the final phase of the country’s NATO accession negotiations in late 2016.

In addition, Montenegro’s leaders say Russia tried to interfere in the country’s October 16, 2016 general elections, a charge that Moscow has denied.

The authorities and the ruling parties claim that Russia sponsored a coup attempt on the election day.

Several Western governments, including the UK, support that interpretation of events.

The government’s critics, however, insist the coup attempt was faked, and was staged to help the veteran pro-Western leader Milo Djukanovic stay in power.

Fancy Bear’s logo. Photo: Facebook.

Bear leaves its tracks:

Three prominent international security companies, Fire Eye, Trend Micro and ESET agree that Fancy Bear staged at least three separate attacks in January, February and June 2017.

Upsurge feared ahead of election:
Ahead of this April’s presidential election in Montenegro, experts warn that the country may experience more cyber threats.
On April 15, citizens will elect anew president, as Filip Vujanovic, is completing his final term and cannot be re-elected.
“Russia has strongly opposed Montenegro’s NATO accession process, so it is likely to continue using cyber capabilities to undermine Montenegro’s role in the alliance,” Pierluigi Paganini, from ENISA, warned.

So-called “lures” – spearphishing emails – are common tactics used by the group to target victims who are tempted to open messages mentioning specific topics relevant to them.

Targets are fooled into believing the email is legitimate. Then, by clicking on the link or attached document, they enable a virus to enter their computers.

Ben Read, from the US security company Fire Eye, told CIN-CG/ BIRN that the emails sent to the Montenegrin Defence Ministry in January 2017 were designed to cause chaos.

“If you opened [them], they would install the malware Game Fish on the victim’s system. That’s signature malware for APT28,” he explained.

He said experts from Fire Eye believed the hackers’ motive was Russia’s deep displeasure over Montenegro’s NATO accession, and the cyber attacks formed part of a broader plan to destabilise the country.

In January 2017, Fire Eye published a report claiming that Fancy Bear primarily targeted entities in the US, Europe, and the countries of the former Soviet Union, including government and military targets, along with defence departments, media outlets, and political dissidents or figures opposed to the Russian government.

“Russia is attacking these governments using both traditional means and as cyber-attacks,” Read added.

Before January 2017, on election day in October 2016, many websites in Montenegro were suddenly taken down by so-called DDoS attacks, in which multiple compromised computer systems attack a website and cause a denial of service for users.

However, the authorities never disclosed what actually happened on that day although they announced a detailed investigation, hinting at a Russian role in the large-scale internet incident.

Four days after the elections, on October 20, 2016, another phishing attack was launched against the parliament of Montenegro, most likely by Fancy Bear again, according to IT security specialists Trend Micro.

But, government sources told CIN-CG/BIRN that this attack was less serious, as it targeted the “wrong location”, the parliament, which does not deal with confidential data.

“It was a blind shot,” said this official who insisted on remain anonymous.

A bigger attack, which the Montenegro government describes as more intense than the one in October 2016, started on February 15, 2017 and peaked over the following days, government sources told CIN-CG/BIRN last year.

This time, websites of the government and state institutions, as well as some pro-government media, suffered a wave of cyber-attacks, officials in Podgorica told CIN-CG/ BIRN.

“The scope and diversity of the attacks, and the fact that they were being undertaken on a professional level, indicates that this was a synchronised action,” an official said.

The next attack, which a European official attributed to the same Russian source, happened in June 2017.

Photo: Pixabay.

Pierluigi Paganini, member of the European Union’s Agency for Network and Information Security, ENISA, told CIN-CG/ BIRN that Montenegrin infrastructure was again targeted by APT28, or Fancy Bear.

“In June 2017, after Montenegro officially joined NATO, the attacks continued; experts at the security firm Fire Eye who analyzed them collected evidence that confirmed the involvement of Russia’s APT,” Paganini said.

He added that the evidence included artefacts, malware, bait documents and exploit codes.

He said that although attribution is always the most difficult part of a forensic investigation, in this case, the information gathered “points directly to the Russian APT28 group”.

BIRN asked the Russian Foreign Ministry about its connections to the group and to its attacks on Montenegro.

It refused to respond specifically, noting only that “the mentioned issues were repeatedly commented on by the Russian Foreign Ministry”.

Russia strongly denies that its state plays any role in hacking governments, media or elections across the globe.

Russian President Vladimir Putin told reporters in June 2017 that hacking groups, like artists, do their own bidding.

“Hackers are like artists who choose their targets, depending how they feel when they wake up in the morning. No such attacks could alter the result of elections in Europe, America or elsewhere,” Putin told reporters.

Attacks disrupted Facebook services:
Major cyber disruption was noted in Montenegro on election day, on October 16, 2016, when people in Montenegro were unable to use services such as Viber and WhatsApp.
The government had to obtain permission from the Higher Court in Podgorica to temporarily block these applications for two hours on the election day and request a thorough investigation of the cyber attack.
Facebook detected this incident in its Transparency report under the title “Internet Disruptions”.
“We are aware of a disruption affecting access to Facebook products and services in Montenegro that took place during October 2016. This disruption impacted messaging services and coincided with the country’s parliamentary elections,” it said.

Cheap way of collecting intelligence:

America disagrees. In a report, published on December 29, 2016, the US Department of Homeland Security, DHS, and the FBI insisted that the Kremlin sponsored Fancy Bear.

Fancy Bear has targeted many important international groups and individuals.

They include Germany’s ruling Christian Democratic Union, CDU, the German Bundestag, NATO, the World Anti-Doping Agency, the US Democratic National Committee, the former White House senior official John Podesta, the US Democratic Congressional Campaign Committee, and others.

Christopher Bing, Associate Editor of CyberScoop, a US cybersecurity website that has followed the attacks in Montenegro, agreed that Fancy Bear has subjected the Balkans to an intensive campaign of cyber-espionage.

“These activities largely serve as a cheap and effective way to collect intelligence remotely and covertly – without getting caught,” he told CIN-CG/ BIRN.

Bing explained that APT28 is a politically motivated threat group that is known to target geopolitical rivals of the Kremlin.

“APT28 is known to target military, governmental and civil society groups that are commonly of interest to the Russian state.

“As part of this targeting pattern, the Balkans represents a territory where Russia remains interested in controlling and asserting its dominance,” Bing explained.

The IT company ESET, known for its anti-virus and firewall products, also confirmed to CIN-CG/BIRN that Fancy Bear was on active manoeuvres in the Balkans during summer 2017.

Not all cyber attacks are Russian:

New analysis by the Public Administration Ministry on cyber threat to Montenegro showed the number of hacking attacks rose in 2017. The attacks were also “much more serious and sophisticated,” it said.

Over 380 attacks on websites, state institutions, online fraud and misuse of personal accounts were reported in 2017. That compared with just six in 2012. The authorities promised to investigate the background to all those attacks.

“The severity and sophistication of cyber-attacks affecting Montenegro during 2017 were reflected in the increased number of identified attacks on infrastructure and cyber espionage cases, as well as through phishing campaigns that targeted civil servants,” the ministry report said.

These attacks caught Montenegro on the hop, as its small cyber security team had no experience of dealing with attacks on this scale. It has only a dozen employees, who are being trained by US and UK cyber experts.

Amid reports that Russian hackers played a role in downing several websites on election day in Montenegro, the government in December adopted new measures to tighten cyber security.

It said it would strengthen the capacity of the police and intelligence services to prevent hacking, after the attacks on election day had highlighted the vulnerability of the entire system.

“It not just Russian hackers that they are dealing with. The small, under-equipped team is also dealing with the increase in online bank frauds and other attacks that do not have political background,” a government official told CIN-CG/BIRN.

Moldovan Politicians Accused of Buying Facebook ‘Likes’

Many politicians in Moldova have attracted thousands of “likes” on their Facebook pages, hinting at their great popularity among the masses.

However, a media probe has uncovered that a suspicious number of these “likes” come from far-away countries with which Moldova has little or no connection.

As a result, politicians and some other persons suspected of corruption in Moldova have been accused of buying fake “likes” on Facebook in Asian countries.

One such figure of suspicion is the country’s pro-Russian President, Igor Dodon. After his  Facebook page was checked by the Moldovan media, it appeared that over 7,000 of his 100,000 “likes” were from fans in India.

Ilan Sor, a politician sentenced to seven years in prison for his role in the notorious theft of a billion US dollars from the banking system, is accused of doing the same.

Sor, who is also mayor of Orhei and the leader of the pro-Russian “Sor Party”, has reportedly accumulated a suspicious number of “likes” for his Facebook page from Indonesia, Bangladesh, India, and Pakistan.

About two-thirds of his 51,000 “likes” come from fans in those countries – and less than a quarter from Moldova itself.

The leader of the Action and Solidarity Party, Maia Sandu, is the most popular Moldovan politician on Facebook, with more than 134,000 likes. President Dodon comes second with more than 101,000.

Third place is taken by the leader of “Our Party”, Renato Usatii, with 5,000 friends – the Facebook limit – and 60,880 followers – Facebook users who follow that page.

Likes can be easily bought from the Internet just typing `buy Facebook likes` by the help of all sort of website ranging from 70 to 100 US dollars for 5,000 to 10,000 `real likes`.

The cheapest ones to buy are from countries in Asia or Africa, although some IT specialists do not recommend this because of the poor engagement of those users and the consequent dramatic drop-down of the page’s “EdgeRank” – a Facebook internal ranking system used to prioritise posts.

Facebook Reveals Serbian Fighters’ Role in Ukraine War

Marko Barovic was always on the wrong side of the law. Growing up in Montenegro, since his teenage years he always hung out with the bad guys.

Not even 30, he already has a conviction for robbery and attempted murder. Now, since April this year, he also has a conviction for taking part in a foreign military conflict, in Ukraine, which is forbidden by law in Montenegro.

Barovic is now serving his three year and six months long prison sentence.

In 2014, as warfare erupted in Ukraine between pro–Russian separatists in the east and Ukrainian fighters, many Russian sympathisers from the Balkans, mostly from Serbia, or Serbs from Bosnia and Herzegovina and Montenegro, joined pro-Russian paramilitary units operating in eastern Ukraine, mainly in the Donetsk area.

According to the court records, Barovic travelled in December 2014 to Russia, and then, just before New Year, to eastern Ukraine, where he got a military card from the self-proclaimed Donetsk People’s Republic.

According to the same military card, he served there initially as a driver and later as a sniper. In October 2015, however, he was arrested on the border between Ukraine and Russia.

Montenegrin prosecutors say the key proof that he fought in Ukraine and did not just drive a truck, as he claimed initially at the trial, was his Facebook profile.

He often posted photos from the battlefield of himself in uniform and holding a rifle. The posts and photos, which were public, were admitted as evidence before the court in Podgorica.

After being confronted with the evidence, Barovic confessed about he had really spent his time in Ukraine. However, he still defended his conduct. He said he had gone there to “help people for moral and patriotic reasons.”

Serbs flocked to help Russian ‘brothers’:

The verdict in April this year against Barovic was a landmark conviction in Montenegro, following the adoption of a law in 2015 that classified fighting on foreign territory as a crime.

In neighbouring Serbia, however, where the number of those who fought in Ukraine as foreign fighters was much higher, there have been no such trials, but only plea agreements.

Around 24 fighters who returned to Serbia last year from Ukraine admitted guilt after the prosecution produced evidence of their presence on battlefields.

Investigators mostly gathered this evidence also by examining their social media profiles.

Plea agreements are not public documents in Serbia, but BIRN sources from prosecutors’ offices say YouTube videos and Facebook photos proved the key evidence in most cases.

The most prominent case was against Radomir Pocuca, a former special police spokesperson, who over several months of fighting in Ukraine posted almost daily videos, photos and other entries related to his time in Donetsk.

Pocuca also claimed that he went to help Serbia’s “Russian brothers” for patriotic reasons, mainly as payback for Russia’s support for Serbia in the dispute over the former province of Kosovo [which declared independence in 2008 – which Serbia has vowed never to recognise].

Serbs also remember that Russian fighters volunteered for the Serbian side in the 1992-5 war in Bosnia, which pitched Serbs against a combination of Croats and Bosniaks [Bosnian Muslims].

For many of the Serbian fighters in Ukraine, this was not their first war.

Ranko Momic, who is believed to be still in Ukraine, escaped trial for alleged war crimes in Kosovo and fled to Donetsk in 2015.

A Bosnian Serb, he fought also in the war on the Serbian side in Croatia in the early 1990s, before taking part in the war in Bosnia, serving in so-called “special” units, such as the notorious Serbian Volunteer Guard.

Even during the 1990s, before mobile phones or social media appeared, these fighters enjoyed being photographed or filmed during their time in battle, and local and international courts used such records to secure convictions for war crimes.

Dejan Beric with DNR passport. Photo: Facebook/Dejan Beric

Among the other better-known Serbian fighters in Ukraine with experience in the Bosnian war is Dejan Beric.

He was recently spotted again in the Donetsk area with a new group of Serbian snipers.

Beric was brought up in Putinci, a village in northern Serbia, where he ran a business making doors and windows in the nearby town of Indjija before closing his business in 2014 and leaving for Ukraine.

Many Balkan volunteers say they joined the rebels out of a deep sympathy with Russia and a sense of Slavic Orthodox Christian brotherhood.

But Beric said that he also went there after being personally invited by two Russian volunteers who previously fought in the Balkan wars in the 1990s.

“They called on me to repay the debt, in terms of moral and human spirit,” Beric told BIRN earlier this year in an interview.

Contrary to some accounts published on the internet, Beric said that becoming a volunteer is simple; would-be fighters need only to catch a plane to Rostov-on-Don in Russia and then take a bus across the border to rebel-held Donetsk or Lugansk in Ukraine.

“I came from Sochi, where I worked, via Odessa to Sevastopol, where I became a member of the ‘Defence of Sevastopol’… Then I went to Donbass,” Beric recalled. 

Beric also regularly updates his Facebook and YouTube account with stories from the battlefield.

Many fighters remain on the run:

Wagner members wanted by the Ukranian secret service.

Social media profiles did not only help the authorities in Serbia and Montenegro to secure convictions; Ukrainian authorities have also used them to issue arrest warrants against the remaining Serbian fighters in the country.

Ukraine’s security service has issued arrest warrants against six Serbian mercenaries, while Kiev authorities maintain that almost 300 Serbs remain fighting in various rebel areas.

The six Serbs, according to Ukraine’s security service, fought in Ukraine in 2014 and then in Syria – another conflict zone in which Russia is deeply involved – in 2015.

All six allegedly belong to Wagner, a military company registered in Argentina, which the Ukrainian security service says serves as a paramilitary unit tasked with fighting for Russian interests across the world.

Among the six fighters wanted by Ukraine is Davor Savicic “Elvis”, a Bosnian Serb, who claims to live in Russia and work on a construction site.

Savicic was reportedly highly appreciated by his superiors at Wagner due to his extensive battlefield experience, and given the codename “Wolf” to reflect his strength and courage in combat.

While these claims could not be independently verified, Savicic’s Facebook profile picture is also, by coincidence, a wolf.

Bosnian police told BIRN that they believe that the mercenaries have a meeting point in Moscow, and that most of them are registered as temporary workers in Russia in order to avoid prosecution at home as foreign fighters.

Police records suggest that Savicic belonged earlier to various Bosnian Serb units, and spent the longest time fighting alongside the so-called Tigers, a notorious paramilitary unit led by Zeljko Raznatovic “Arkan”.

He who was killed in 2000 before he could face trial for war crimes by the international criminal tribunal for former Yugoslavia, ICTY, in the Hague.

Serbian volunteers in Ukraine.

In 2001, the Montenegrin prosecution accused Savicic and three others of planting a bomb in the house of Dusko Martinovic in the town of Berane, which killed six people. Martinovic allegedly owed them around 15,000 euros.

Savicic was initially jailed for 20 years in absentia in Montenegro, but an appeal court ruled later that there was not enough evidence to prove that he was responsible for the bombing.

From 2001 until his acquittal in 2014, Montenegrin police tracked him from Bosnia to France, Spain and Russia, but never managed to arrest him.

The same year Savicic was cleared, photographs appeared of him on the frontline in Lugansk, after he and an estimated 50 other Serbian fighters brought their battlefield skills to the aid of pro-Russian rebels against the Ukrainian government, according to the Bosnian prosecution.

Russia appears to have deployed them using similar methods to those Serbia used in the Bosnian war, when Serbia denied any direct involvement in the conflict and insisted all the Serbian citizens who took part in it were volunteers. Russia has done the same in Ukraine.

Wagner fighters have also fought for Russia’s Syrian ally, President Assad, and although many of them have denied the reports, news from Syria suggests that a number of them lost their lives fighting Assad’s jihadist foes.

Among them was Dimitrije Sasa Jojic whose death aged 25 was announced this June by the Serbian football fan group Firma, to which Jojic belonged before taking the path of a foreign mercenary.

Jojic also initially fought in Ukraine and had been active on social media there, posing in uniform and with other fighters.

It is believed that he was part of the same group from Wagner that went to Syria. Jojic was buried in Moscow this summer.

Other Serbian fighters, allegedly members of Wagner, and also wanted by Ukraine are believed to be stationed in Russia, travelling occasionally to rebel-held areas of Ukraine. All of them have Serbian or Bosnian passports.

Unlike Barovic or Pocuca – who were extradited from Ukraine and Russia – the Wagner men are seen as far more important for both sides in the conflict.

They are important for Russia, as their methods shed light on the hidden ways Russia exports fighters to the conflict zone.

They are equally important for Ukraine, which hold them responsible for numerous attacks that killed hundreds of people.

In consequence, as security experts have told BIRN, their extradition and arrest is highly unlikely.

Romanian Protesters Vow to Overcome Net Saboteurs

Mihai Sora, a well-known Romanian writer and philosopher, marched last Sunday in his Transylvanian town of Alba Iulia alongside hundreds of others who took to the streets that day against the push by the ruling Social Democrat-led coalition to adopt laws that threatens years of anti-corruption efforts.

Over 45,000 people across Romania did the same, with 25,000 marching in the capital, Bucharest, alone.

Sora, who is 101, is one of Romania’s most followed celebrities on Facebook whose posts get thousands of shares.

A picture of him at Sunday’s march made headlines in Romania, while on Tuesday he announced on Facebook that he had been “reported.”

Sora experienced what scores of activists, protesters and social media users who supported the demonstrations and posted videos from the protests also encountered this week.

Access to their accounts was blocked suddenly by Facebook, after what they believe were attempts by government supporters to harass them by reporting their accounts as spam generators.

“I have been reported (it seems this is the right word for it). In other times, under different rulers, there was snitching – very lucrative for some and, in any case, meant to keep under control any strand of hair with rebel tendencies; in the last years of Ceausescu’s regime it became a reflex for many people,” Sora wrote on his page on Tuesday.

“I had to live, it seems, in order to see and understand new technologies, starting with Facebook,” he concluded.

The writer said that he had since sent a canned copy of his ID “somewhere into the ether” and his account was unblocked.

An algorithm error:

A Facebook spokesperson told BIRN on Tuesday that “a number of pages were temporarily blocked due to an error in our automated systems.

“As soon as this was brought to our attention, we disabled those blocks. We apologize for any inconvenience caused by these pages being unavailable for a few hours,” the spokesperson added, without explaining what the error was.

Mihaela Pana, journalist and founder of Cyber Media website, told BIRN that the “error in the automated systems” means the algorithm used by Facebook simply did what it was told to do following a series of complaints filed against those accounts.

“This is the dark side of using algorithms,” she explained. “If some people use the online to do good, others abuse the algorithm system and act like anonymous vigilantes, trolling whatever they see fit,” she added.

Such vigilantes can serve whatever interest is there. This trend did not only apply to Facebook, she said.

“Yesterday, I spent a whole day finding a series of Russia-based bots on Twitter, mimicking Romanian names. It’s really difficult to quantify this phenomenon, to find these accounts and see what interests they serve,” she pointed out. “Basically, there is no safe medium out there.”

However, she says people can be taught better how to protect themselves.

What happened with the accounts of the Romanian activists shows there is still a need for people to understand how to protect themselves from abuse: either to compartmentalize their online activity, with separate accounts for personal and professional purposes, or simply to anonymize their personal life.

Resilient protesters:

Some activists whose accounts were blocked responded immediately by setting up fan pages with several administrators, so that if their accounts were blocked again, they would still be able to post on their pages.

Oana Dobre Dimofte, a former journalist and supporter of the protests, was one of many who then set up a fan page “just in case.”

“We’re interested in whether it was an orchestrated move or not,” she told BIRN about the blocking phenomenon.

She knows Facebook cannot say that by looking at an algorithm, “but we are convinced it was a political move because certain accounts were targeted,” she added.

To avoid renewed protests in Bucharest’s Victoriei Square, in front of the government headquarters, the Bucharest city council, also dominated by the Social Democrats, on Tuesday decided to set up a second Christmas fair in the square from December 2 to December 20.

An amusement park has already been set up in front of the parliament building in central Bucharest.

The Ministry of Interior on Wednesday said it was also investigating protesters who allegedly assaulted police on horseback at Sunday’s protests, blinding the animals with flashlights.

But Dobre says that neither online trolling nor measures taken by the authorities would stop the protesters from taking to the streets again.

“They made us get out of our houses at midnight [on January 31, when the government issued a decree pardoning corruption offences] and we took to the streets,” she recalled.

“They sent people with Molotov cocktails against us and we came back again; they threatened us with child protection legislation because we took children to the protests, and we continued to take them with us; do they think we’re going to be scared of some mulled wine?” she asked.

Social Democrat politicians BIRN tried to contact to refused to comment.

Another protest against the government, meanwhile, is scheduled for Friday December 1.

BIRD Community

Are you a professional journalist or a media worker looking for an easily searchable and comprehensive database and interested in safely (re)connecting with more than thousands of colleagues from Southeastern and Central Europe?

We created BIRD Community, a place where you can have it all!

Join Now